What I look at
- The product, source repositories and how the major parts fit together.
- Hosting, deployment, databases, external services and important dependencies.
- Authentication, data handling, secrets and obvious security exposure.
- Operational basics such as backups, recovery, monitoring and ownership of critical accounts.
- Maintainability, engineering workflow and areas where accumulated complexity is starting to matter.